Striking a Balance: Enhancing IAM Security While Maintaining Ease of Use in Higher Education

Eric Zematis and Forest Crowley (Lehigh University): Higher education institutions struggle to balance IAM security and convenience due to their diverse community base with varying needs and the ‘open’ culture. This is further complicated by adversaries identifying education as a soft target and stringent compliance requirements.

Matt Morton (University of Chicago): Identity is at the core of most attacks today and it also has the most impact on users when steps are taken to secure accounts or change processes. As a result, it’s important to balance these items carefully with the risks that are being mitigated.

Eric Zematis and Forest Crowley (Lehigh University): We continue to see a significant volume of email-based phishing attacks. In addition, we are seeing more phone/SMS impersonation attacks. This has been a challenge for our Help Desk, which now needs to initiate Zoom calls for ID verification.

Matt Morton (University of Chicago): We are seeing an increase in attacks at the service desk where the threat actors are attempting to reset credentials like passwords and Duo phone numbers by calling in. We require a visual recertification via Zoom, but it is putting a significant workload on the desk that was not planned for.

Eric Zematis and Forest Crowley (Lehigh University): A key challenge to strengthening identity security is user friction. User authentication occurs so frequently that small changes can often be a major obstacle. 

Another challenge is securing limited resources (money and personnel) to properly implement and maintain IAM systems, which are often complex and require continuous attention.

Matt Morton (University of Chicago): Many faculty and researchers engage in extensive international collaborations, which broadens the attack surface for both their accounts and those of their collaborators. Securing by geolocation alone is insufficient. It’s essential that the support desk is trained to recognize international identifiers and can work without bias or assumptions when verifying this group.

Eric Zematis and Forest Crowley (Lehigh University): When implementing new security measures, like multi-factor authentication (MFA,) clearly explaining the ‘why’ behind the change can significantly reduce resistance and improve overall security posture. People are more likely to embrace security measures when they understand their importance and how they benefit, rather than feeling like they’re just pointless hurdles to overcome.

Matt Morton (University of Chicago): One key lesson I’ve learned in navigating the balance between security and usability in IAM is that user experience is critical to security adoption. Striking the right balance requires simplifying the user journey wherever possible — especially in tasks like authentication and access requests — while implementing robust security controls. 

For example, adopting technologies like single sign-on (SSO) and adaptive MFA can improve both security and usability by reducing friction for users in low-risk scenarios while tightening controls in higher-risk contexts. 

Ultimately, aligning security requirements with user convenience enhances compliance and reduces the likelihood of security workarounds or “shadow IT.”

Eric Zematis and Forest Crowley (Lehigh University): Attendees should leave recognizing that IAM is not a ‘set it and forget it’ task, but requires continuous monitoring and adaptation to emerging threats like social engineering. They should be prepared to proactively update policies, educate users, and evolve their security measures to stay ahead of these ever-changing threats.

Matt Morton (University of Chicago): I hope attendees leave this webinar with a clear understanding of how critical it is to strike the right balance between robust security controls and user experience in IAM. I want them to take away practical strategies for enhancing IAM practices, such as implementing adaptive MFA, enforcing least privilege access, and improving identity governance. 

Additionally, I hope they recognize the importance of ongoing user education and integrating IAM with other security tools like threat detection systems to protect against emerging threats. 

Overall, I think the goal is for attendees to feel empowered to strengthen their IAM frameworks in a way that not only improves security but also supports operational efficiency and user adoption.